Security tooling for AI agent skills is borrowed from the static package world, and the borrowing does not hold. When Cisco, Nvidia, and skills.sh scanners cleared the planted skill , they were doing exactly what they were designed to do — evaluate an artifact at a point in time. The attack worked because the artifact changed after that evaluation. No scanner improvement fixes this; the flaw is in assuming that a one-time check governs ongoing behavior.
For organizations deploying agentic AI at scale, the Vercel AI SDK's unified model interface and similar abstraction layers compound the exposure: the same skill can run across , , , and other backends simultaneously, meaning a mutating payload propagates across the entire fleet rather than a single deployment. The fix is not a better scanner — it is a security architecture that treats installed skills as continuously untrusted runtime code. Every organization that has not made that shift is operating on a cleared certificate for an artifact that may have already changed.